Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in the repository restoration command allows an attacker to trick an administrator into importing a malicious backup file. If successful, the Gitea server can be forced to connect to internal network services or disclose local files, potentially leading to the exposure of sensitive internal data or other private source code repositories.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea's `restore-repo` CLI command due to insufficient validation of the `Head.CloneURL` field in `pull_request.yml`. While a safety check function `CheckAndEnsureSafePR` exists, the `restore.go` component calls it with an empty `commonCloneBaseURL` string. In Go, `strings.HasPrefix(url, "")` always returns true, effectively bypassing the security check. An attacker can provide a malicious repository dump that, when restored by an administrator, causes the Gitea server to execute `git fetch` against arbitrary URLs or local paths via the `file://` protocol. This can be used to probe internal network services or read local git repositories accessible to the Gitea process. The issue is patched in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 1.27.0